ctrlb-decompose
LLM-ready reasoning surface over logs
What is it?
What it is
A command‑line tool, WASM binary, or Rust library that compresses raw log lines into a small set of structural patterns enriched with statistics, anomaly flags, and correlation scores.
Why it exists
Logs are often millions of noisy lines that are hard to analyze. ctrlb‑decompose reduces the data volume by 99.9% while extracting actionable insights—typed variables, quantile stats, anomaly detection, and severity scoring—making troubleshooting faster and more accurate.
Who should use it
System administrators, DevOps engineers, SREs, and developers who need to analyze large, noisy log files and extract actionable patterns, anomalies, and correlations.
Who should avoid it
Users who only work with very small log files, prefer fully managed cloud logging services, or lack comfort with command‑line tools and Rust binaries.
How it works
A quick walkthrough in plain English
How ctrlb-decompose works
Step 1 of 3
You interact with it
Open ctrlb-decompose, send a request, or connect it to your stack.
Features
Advantages
- Achieves high compression ratios (e.g., 99.9% reduction as shown in example)
- Provides actionable patterns with embedded statistics for rapid insight
- Minimal memory footprint due to efficient probabilistic data structures
- No second pass required (true streaming processing)
- Flexible deployment options (CLI, browser via WASM, library)
- Automatic semantic typing enhances pattern interpretability
- Built-in anomaly detection and severity scoring reduces manual analysis
- Multiple output formats cater to different users (engineers, LLMs, automated systems)
- MIT licensed open source project
Disadvantages
- Default Drain3 cluster limit of 10k patterns may require tuning for extremely diverse logs (tuning options not exposed in basic CLI)
- Approximate nature of statistical sketches (DDSketch for quantiles, HyperLogLog for cardinality) may not meet exact counting requirements
- Being an early-stage tool (version 0.1.0), it may have fewer features, less documentation, and smaller community compared to established alternatives
Installation
native
macOS: brew tap ctrlb-hq/tap && brew install ctrlb-decompose; Debian/Ubuntu: curl -LO https://github.com/ctrlb-hq/ctrlb-decompose/releases/download/v0.1.0/ctrlb-decompose_0.1.0-1_amd64.deb && sudo dpkg -i ctrlb-decompose_0.1.0-1_amd64.deb; Source: git clone https://github.com/ctrlb-hq/ctrlb-decompose.git && cd ctrlb-decompose && cargo build --release
FAQ
How do I install ctrlb-decompose on macOS using Homebrew?
Run `brew tap ctrlb-hq/tap` followed by `brew install ctrlb-decompose`.
What command should I use to get LLM‑optimized output from ctrlb-decompose?
Use the `--llm` flag, e.g., `ctrlb-decompose --llm app.log`.
Which output format is best for programmatic consumption and how do I enable it?
The JSON format (`--json`) provides structured, machine‑readable output.
How does ctrlb-decompose reduce log volume and what techniques does it use?
It normalizes log lines with CLP encoding, clusters them via Drain3, extracts typed variables, and computes statistics, achieving up to 99.9% reduction.
Can I analyze logs directly from Claude Code without knowing the CLI?
Yes—install the plugin with `/plugin marketplace add ctrlb-hq/ctrlb-decompose` and `/plugin install ctrlb-decompose@ctrlb-hq`, then ask Claude to analyze logs in plain language.
What variable types does ctrlb-decompose automatically detect and how are they classified?
It detects IPv4+ (CIDR match), UUID (8‑4‑4‑4‑12 hex), Duration (numeric + time unit), HexID (4+ hex digits), Integer (i64), Float (contains '.'), Enum (≤20 unique, top‑3 ≥80%), Timestamp (RFC 3339), and String (fallback).
Featured in Videos
YouTube tutorials and walkthroughs for ctrlb-decompose
Alternatives
Similar projects ranked by category, topics, and text overlap.